This lab is vulnerable to username enumeration using its response times. To solve the lab, enumerate a valid username, brute-force this user's password, then access their account page. Log in using ...

Each installation of Burp generates its own CA certificate that Proxy listeners use to negotiate TLS connections. This section explains how to export, import, and ...

Burp's proxy listener is a local HTTP proxy server that listens for incoming connections from your browser. It allows you to monitor and intercept all HTTP requests and responses sent and received by ...

Burp Suite DAST uses role-based access control to manage permissions for your users. For more information, see Role-based access control. You can add users to Burp Suite DAST locally, or using single ...

Many servers now support HTTP/2. This exposes them to potential vulnerabilities that are impossible to test for using tools that only speak HTTP/1. Burp Suite provides unrivaled support for ...

In this section, we'll provide some simple steps you can take to resolve common issues when trying to test mobile apps using Burp Suite.

Custom actions are scripts that run directly in Burp Repeater to automate tasks and extract information during manual testing. This page includes useful code snippets and building block examples of ...

When configuring application logins for a scan, you can import a recorded login sequence rather than supplying basic user credentials. A recorded login sequence is a set of instructions that tell Burp ...

Burp Suite brings AI to your security testing in two complementary ways: Burp AT, which brings agentic AI to human-led pentesting, and Burp AI, which assists you within the Burp tools you already use.

Go to the Dashboard tab. Select the relevant entry from the list of tasks. From here, you can view all kinds of information about the task and its results. Note that the available information depends ...

You can set the type of payload that you want to inject into the base request. Burp Intruder provides a range of options for auto-generating different types of ...

You need to configure Firefox so that you can use it for testing with Burp Suite.